CVE-2026-53084

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: return VMA snapshot from task_vma iterator<br /> <br /> Holding the per-VMA lock across the BPF program body creates a lock<br /> ordering problem when helpers acquire locks that depend on mmap_lock:<br /> <br /> vm_lock -&gt; i_rwsem -&gt; mmap_lock -&gt; vm_lock<br /> <br /> Snapshot the VMA under the per-VMA lock in _next() via memcpy(), then<br /> drop the lock before returning. The BPF program accesses only the<br /> snapshot.<br /> <br /> The verifier only trusts vm_mm and vm_file pointers (see<br /> BTF_TYPE_SAFE_TRUSTED_OR_NULL in verifier.c). vm_file is reference-<br /> counted with get_file() under the lock and released via fput() on the<br /> next iteration or in _destroy(). vm_mm is already correct because<br /> lock_vma_under_rcu() verifies vma-&gt;vm_mm == mm. All other pointers<br /> are left as-is by memcpy() since the verifier treats them as untrusted.